CVE-2008-2249

🗓️ 10 Dec 2008 13:33:00Reported by microsoftType

Integer overflow in GDI in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows remote attackers to execute arbitrary code via a malformed header in a crafted WMF file, which triggers a buffer overflow

Reporter	Title	Published	Views	Family All 12
Check Point Advisories	Microsoft Windows GDI WMF File HeaderSize Buffer Overflow (MS08-071; CVE-2008-2249)	9 Dec 200800:00	–	checkpoint_advisories
Cvelist	CVE-2008-2249	10 Dec 200813:33	–	cvelist
NVD	CVE-2008-2249	10 Dec 200814:00	–	nvd
OpenVAS	Vulnerabilities in GDI Could Allow Remote Code Execution (956802)	10 Dec 200800:00	–	openvas
OpenVAS	Vulnerabilities in GDI Could Allow Remote Code Execution (956802)	10 Dec 200800:00	–	openvas
Prion	Integer overflow	10 Dec 200814:00	–	prion
Positive Technologies	PT-2008-3744 · Microsoft · Wmf +2	10 Dec 200800:00	–	ptsecurity
securityvulns	Microsoft Security Bulletin MS08-071 – Critical Vulnerabilities in GDI Could Allow Remote Code Execution (956802)	10 Dec 200800:00	–	securityvulns
securityvulns	iDefense Security Advisory 12.09.08: Microsoft Windows Graphics Device Interface Integer Overflow Vulnerability	10 Dec 200800:00	–	securityvulns
securityvulns	Microsoft Windows GDI library multiple security vulnerabilities	10 Dec 200800:00	–	securityvulns

NVD

Node

microsoft windows_2000sp4

microsoft windows_2003_serversp1

microsoft windows_2003_serversp2

microsoft windows_2003_serversp2x64

microsoft windows_server_2003sp1itanium

microsoft windows_server_2003sp2

microsoft windows_server_2003x64

microsoft windows_server_2008itanium

microsoft windows_server_2008x32

microsoft windows_server_2008x64

microsoft windows_vistax64

microsoft windows_vistasp1

microsoft windows_vistaMatchgold

microsoft windows_xppro_x64

microsoft windows_xpsp2

microsoft windows_xpsp2pro_x64

microsoft windows_xpsp3

Source	Link
securitytracker	www.securitytracker.com/id
oval	www.oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5984
vupen	www.vupen.com/english/advisories/2008/3383
us-cert	www.us-cert.gov/cas/techalerts/TA08-344A.html
docs	www.docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-071
labs	www.labs.idefense.com/intelligence/vulnerabilities/display.php

23 Apr 2026 00:35Current

7.8High risk

Vulners AI Score7.8

CVSS 29.3

EPSS0.68721

CWE-189